A vulnerability disclosure policy (VDP), also referred to as a responsible disclosure policy, describes how an organization will handle reports of vulnerabilities submitted by ethical hackers. A VDP must thus be easily identifiable via a simple way, a security.txt notice.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

# Please encrypt the body of all email communication directly.
# In other words, DONT use PGP-MIME :)
Contact: security@stjude.cloud
Encryption: https://stjude.cloud/pubkey-640BA18B.txt
Preferred-Languages: en

# Multiple sites within the St. Jude Cloud ecosystem
# use this security.txt file.
Canonical: https://stjude.cloud/.well-known/security.txt
Canonical: https://platform.stjude.cloud/.well-known/security.txt
Canonical: https://pecan.stjude.cloud/.well-known/security.txt
Canonical: https://viz.stjude.cloud/.well-known/security.txt

# Any other stjude.cloud domain is acceptable. We provide
# this entry so that the security.txt file is not required
# to be updated upon a new subdomain release.
Canonical: https://*.stjude.cloud/.well-known/security.txt

# Search for "Information Security"
Hiring: https://www.stjude.org/jobs.html
Expires: Wed, 5 Jan 2022 00:00:00 -0800
-----BEGIN PGP SIGNATURE-----

iQIyBAEBCAAdFiEERkqqBmNIRIIhnAxt8XG9MmQLoYsFAl/2froACgkQ8XG9MmQL
oYsIfg/47pTl0zGZhvJnfSjcn0iQEwv9+/c4MMTOLPZE2HUbOSVPr5dPOB45Ctef
c7BlN24o88JWGlaaxv2D6QuDIoJSqFJC7hIC/LdoCxw+3F3KQllTOJFk95tU7ETD
GNNH0/YPh3LhuTjmyOk4QfV1iQlhdyipj770RtjQDRhNNOtIE/cWoF0Gcd65iRKn
xYYksB5IfOWA+YL7QsE3f/4ZmgUykw89XW6cssOIHGzMAm9oA16yihtCFT59Ci0e
e81zCsOo/ozElM7p811ZuVI1gqwCKNrOOU/RNEfzaxdPwG4c4qdsFj9QF20h26Gv
m0/GqQzjB/aJ8NqhuWHB2lh3IcRQYv2v64yObmISwLqOVh9jy4tDy/ykIqegdUjO
Rb2tp1aE4h+wWImvY5+A6SEe64sCuC1okE78V7gafbaKCDA+835oDeaO1/x5DvJZ
BcyuDnZrduvgSbARXiy+G+NIkUSV9arOZsuatUA1To4gFT/AC03W/jiIKBnOX+M2
nIrEuvDDxiV4lQKOxyTbCKAFusFA4r2axSgxJz0p1gfJcl8CeL57SaCLRP3ZYevD
jRgIT7Ub/P/ZpHfTtJg5Wm0q4A03nx5GCQUEd8ha9gKQlJM2hTmRxEsVrQNWiM/O
u87PXQ2ZGkzGnrYw7Kf+SF0T4xxpmtEDU+yDRCszygcC/ggGqA==
=wfHY
-----END PGP SIGNATURE-----